Health monitor based distributed denial of service attack mitigation

ABSTRACT

Provided are methods and systems for mitigating a DDoS event. The method may comprise receiving an indication of a collapse of a collapsible virtual data circuit associated with network data traffic. In response to the received indication of the collapse, the collapse may be attributed to the DDoS event. Furthermore, the method may comprise redirecting the network data traffic to one or more DDoS mitigation services. The method may further comprise mitigating the DDoS event by the one or more DDoS mitigation services.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of, and claims the prioritybenefit of, U.S. patent application Ser. No. 14/010,221 filed on Aug.26, 2013, entitled “Health Monitor Based Distributed Denial of ServiceAttack Mitigation,” the disclosure of which is incorporated herein byreference in its entirety for all purposes.

TECHNICAL FIELD

This disclosure relates generally to computer and network security and,more particularly, to mitigation of distributed denial of service (DDoS)attacks.

BACKGROUND

The approaches described in this section could be pursued but are notnecessarily approaches that have previously been conceived or pursued.Therefore, unless otherwise indicated, it should not be assumed that anyof the approaches described in this section qualify as prior art merelyby virtue of their inclusion in this section.

A Denial of Service (DoS) attack is typically an attempt to make anetwork machine or network resource unavailable to intended users.Generally speaking, a DoS attack is an attempt to overwhelm the capacityof a server in order to interrupt or suspend functioning of networkresources associated with the server. Traditional methods for detectingDoS attacks are typically based on monitoring incoming traffic anddetecting the DoS attack based on an observation of a large increase intraffic, especially when a large portion of the traffic originates froma single IP address. In this case, mitigating the DoS attack includesfiltering out the traffic associated with any IP addresses identified asmalicious.

However, the aforementioned technique for mitigating a DOS attack maynot be very effective in mitigating a Distributed Denial of Service(DDoS) attack. In case of a DDoS attack, incoming traffic may originatefrom a large number of attacking machines, each having a distinct IPaddress.

SUMMARY

This summary is provided to introduce a selection of concepts in asimplified form that are further described in the Detailed Descriptionbelow. This summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used as an aid in determining the scope of the claimed subjectmatter.

The present disclosure is related to approaches for mitigating a DDoSattack. Specifically, a method for mitigating a DDoS attack may comprisereceiving an indication of a collapse of a collapsible virtual datacircuit associated with network data traffic. In response to thereceived indication of the collapse, the collapse may be attributed tothe DDoS event. Furthermore, the method may comprise redirecting thenetwork data traffic to one or more DDoS mitigation services. The methodmay further comprise mitigating the DDoS event by the one or more DDoSmitigation services.

According to another approach of the present disclosure, there isprovided a system for mitigating a DDoS event. The system may comprise aprocessor. The processor of the system may be configurable to receive anindication of a collapse of a collapsible virtual data circuitassociated with network data traffic. In response to the indication, theprocessor may attribute the collapse to the DDoS event. Furthermore, theprocessor may be configurable to redirect the network data traffic toone or more DDoS mitigation services. The processor may further mitigatethe DDoS event by the one or more DDoS mitigation services.

In further example embodiments of the present disclosure, the methodsteps are stored on a machine-readable medium comprising instructions,which when implemented by one or more processors perform the recitedsteps. In yet further example embodiments, hardware systems, or devicescan be adapted to perform the recited steps. Other features, examples,and embodiments are described below.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments are illustrated by way of example, and not by limitation, inthe figures of the accompanying drawings, in which like referencesindicate similar elements and in which:

FIG. 1 shows an environment within which a method and a system formitigating a DDoS event can be implemented, according to an exampleembodiment.

FIG. 2 is a process flow diagram showing a method for mitigating a DDoSevent, according to an example embodiment.

FIG. 3 is a block diagram showing various modules of a system formitigating a DDoS event, according to an example embodiment.

FIG. 4 shows a diagrammatic representation of a computing device for amachine in the example electronic form of a computer system, withinwhich a set of instructions for causing the machine to perform any oneor more of the methodologies discussed herein can be executed.

DETAILED DESCRIPTION

The following detailed description includes references to theaccompanying drawings, which form a part of the detailed description.The drawings show illustrations in accordance with example embodiments.These example embodiments, which are also referred to herein as“examples,” are described in enough detail to enable those skilled inthe art to practice the present subject matter. The embodiments can becombined, other embodiments can be utilized, or structural, logical, andelectrical changes can be made without departing from the scope of whatis claimed. The following detailed description is therefore not to betaken in a limiting sense, and the scope is defined by the appendedclaims and their equivalents. In this document, the terms “a” and “an”are used, as is common in patent documents, to include one or more thanone. In this document, the term “or” is used to refer to a nonexclusive“or,” such that “A or B” includes “A but not B,” “B but not A,” and “Aand B,” unless otherwise indicated.

The techniques of the embodiments disclosed herein may be implementedusing a variety of technologies. For example, the methods describedherein may be implemented in software executing on a computer system orin hardware utilizing either a combination of microprocessors or otherspecially designed application-specific integrated circuits (ASICs),programmable logic devices, or various combinations thereof. Inparticular, the methods described herein may be implemented by a seriesof computer-executable instructions residing on a storage medium such asa disk drive, or computer-readable medium. It should be noted thatmethods disclosed herein can be implemented by a computer (e.g., adesktop computer, tablet computer, laptop computer), game console,handheld gaming device, cellular phone, smart phone, smart televisionsystem, and so forth.

As outlined in the summary, the embodiments of the present disclosurerefer to mitigating a DDoS event. As used herein, “a DDoS event” maycomprise a DDoS attack directed at a network machine or a networkresource. A system for mitigating a DDoS event may evaluate health orstate of a remote network machine or resource to identify a DDoS eventaffecting the network machine or resource and to automatically trigger aDDoS mitigation service. The system for mitigating the DDoS event maycomprise a health monitor configured as a collapsible virtual datacircuit. The collapsible virtual data circuit may refer to a virtualcircuit configured to stop flow of data traffic as an indication of aDDoS event. During normal mode of operation, network traffic may bedirected through the collapsible virtual data circuit. When thecollapsible virtual data circuit collapses an additional circuit isactivated and the traffic is routed through the additional circuit.

The health monitoring may involve software, hardware, signaling, andvarious database queries configured to determine the state of a networkor resource. In a normal operation mode of the network or resource, thehealth monitor may utilize various health checks of the network orresource to determine the state of the system. While the health monitoris operational and the state of the network or resource can besuccessfully verified, there is no need to utilize the DDoS mitigationservice. If the state of the network or resource cannot be verified, orin other words, the health monitor fails and the collapsible virtualdata circuit collapses, another virtual data circuit can be established.When another virtual circuit data is established, the incoming trafficof the network or resource is redirected through the DDoS mitigationservice, where the DDoS data packets are filtered by the DDoS mitigationservice and redirected to the destination network or resource.

Thus, failure of the health monitor may be attributed to the presence ofa DDoS event and cause rerouting of the traffic to the DDoS mitigationservice. Once it is determined that the network or resource is no longerexperiencing a DDoS event, the ability of the health monitor to checkthe state of the network or resource is restored by redirecting thenetwork traffic from the DDoS mitigation service back to the network orresource.

Referring now to the drawings, FIG. 1 illustrates an environment 100within which a method and a system for mitigating a DDoS attack can beimplemented. The environment 100 may include a network 110, an entity120, a health monitor 130, and a DDoS mitigation service 140. The entity120 may include a network machine or a network resource that is in needof protection from a DDoS event. In case a DDoS attack 150 is targetedto the entity 120, a DDoS event may be diagnosed in the entity 120.

The network 110 may include the Internet or any other network capable ofcommunicating data between devices. Suitable networks may include orinterface with any one or more of, for instance, a local intranet, a PAN(Personal Area Network), a LAN (Local Area Network), a WAN (Wide AreaNetwork), a MAN (Metropolitan Area Network), a virtual private network(VPN), a storage area network (SAN), a frame relay connection, anAdvanced Intelligent Network (AIN) connection, a synchronous opticalnetwork (SONET) connection, a digital T1, T3, E1 or E3 line, DigitalData Service (DDS) connection, DSL (Digital Subscriber Line) connection,an Ethernet connection, an ISDN (Integrated Services Digital Network)line, a dial-up port such as a V.90, V.34 or V.34bis analog modemconnection, a cable modem, an ATM (Asynchronous Transfer Mode)connection, or an FDDI (Fiber Distributed Data Interface) or CDDI(Copper Distributed Data Interface) connection. Furthermore,communications may also include links to any of a variety of wirelessnetworks, including WAP (Wireless Application Protocol), GPRS (GeneralPacket Radio Service), GSM (Global System for Mobile Communication),CDMA (Code Division Multiple Access) or TDMA (Time Division MultipleAccess), cellular phone networks, GPS (Global Positioning System), CDPD(cellular digital packet data), RIM (Research in Motion, Limited) duplexpaging network, Bluetooth radio, or an IEEE 802.11-based radio frequencynetwork. The network 110 can further include or interface with any oneor more of an RS-232 serial connection, an IEEE-1394 (Firewire)connection, a Fiber Channel connection, an IrDA (infrared) port, a SCSI(Small Computer Systems Interface) connection, a USB (Universal SerialBus) connection or other wired or wireless, digital or analog interfaceor connection, mesh or Digi® networking. The network 110 may include anetwork of data processing nodes that are interconnected for the purposeof data communication.

As shown, the health monitor 130 may be connected to the network 110.The health monitor 130 may be expressed by means of software, hardware,signaling, database query or any means of notification that would occurover an Ethernet, Internet protocol (IP), or a software defined network(SDN) where the state of the entity can be monitored for DDoSentanglement. The signaling may include transmitting notifications andmessages over the Ethernet, IP, or the SDN. The database query may beperformed, e.g., by using a combination of a plurality of predefinedsearch criteria options. Thus, the health monitor 130 may be configuredto monitor and determine a current state of the entity 120. The healthmonitor 130 may ensure notification of a DDoS event during normaloperation of the entity 120.

The environment 100 may further comprise an application deliverycontroller (ADC) (not shown) and an external DDoS service (not shown),both connected to the network 110. Typically, the ADC includes a networkappliance that manages the load balancing and delivery of servicesessions from client host computers to servers based on incoming servicerequests. The external DDoS service may be a service provided by anappliance disposed outside a network associated with the entity 120. Theexternal DDoS service may provide assistance associated with DDoSentanglement.

The health monitor 130 may be connected to an ADC, a DDoS mitigationservice, an external DDoS service, or any generic service. The purposeof the connection is to confirm that the state of the service providedby the entity is not affected by a DDoS event.

FIG. 2 is a process flow diagram showing a method 200 for mitigating aDDoS event, according to an example embodiment. The method 200 may beperformed by processing logic that may comprise hardware (e.g., decisionmaking logic, dedicated logic, programmable logic, and microcode),software (such as software run on a general-purpose computer system or adedicated machine), or a combination of both.

The method 200 may commence with receiving an indication of a collapseof a collapsible virtual data circuit associated with network datatraffic at operation 202. In a sample embodiment, the virtual datacircuit may be established by one or more of the following: software,hardware, signaling, and the like. The indication of the collapse may beestablished upon a notification from a health monitor associated withthe collapsible virtual data circuit. The notification may indicate aninterruption of the network data traffic through the collapsible virtualdata circuit. In response to the received indication, the collapse maybe attributed to the DDoS event at operation 204. In response, atoperation 206, the network data traffic may be redirected to one or moreDDoS mitigation services.

At operation 208, the DDoS event may be mitigated by the one or moreDDoS mitigation services. The DDoS mitigation service may beconfigurable to analyze the network data traffic to detect DDoS datapackages, i.e. data packages sent by an originator of the DDoS event.Furthermore, the DDoS mitigation service may be configurable to filterthe DDoS data packages to provide a filtered network data traffic.

At optional operation 210, the method may further comprise receiving anindication of reestablishment of the network data traffic through thecollapsible virtual data circuit. This indication may be received inresponse to a request sent to a health monitor associated with thecollapsible virtual data circuit. The notification may be indicative ofthe presence of the network data traffic in the collapsible virtual datacircuit. The received notification concerning the network data trafficthrough the collapsible virtual data circuit may be attributed to asuccessful mitigation of the DDoS event. In response to the receivedindication, the network data traffic may be directed back to thecollapsible virtual data circuit at optional operation 212. The networkdata traffic directed back to the collapsible virtual data circuit mayinclude the filtered network data traffic filtered by the DDoSmitigation service.

In an example embodiment, the indication of the collapse of thecollapsible virtual data circuit and the indication of reestablishmentof the network data traffic through the collapsible virtual data circuitmay be performed by at least one of the following: Ethernet, IP, andSDN. Optionally, the method 200 may comprise changing a Domain NameSystem (DNS) name upon receiving the indication of the collapse of thecollapsible virtual data circuit.

FIG. 3 shows a block diagram showing various modules of an exemplarysystem 300 for mitigating a DDoS event. Specifically, the system 300 mayinclude a processor 302. The processor 302 may be configurable toreceive an indication of a collapse of a collapsible virtual datacircuit associated with network data traffic. The virtual data circuitmay be established by one or more of the following: software, signaling,and the like. To receive the indication of the collapse, the processor302 may send a request to a health monitor associated with thecollapsible virtual data circuit. In response to the request, theprocessor 302 may receive, from the health monitor, a notification aboutinterruption of the network data traffic through the collapsible virtualdata circuit.

Furthermore, the processor 302 may be configurable to attribute, inresponse to the received indication, the collapse to the DDoS event.When the DDoS event is detected, the processor 302 may be furtherconfigurable to redirect the network data traffic to one or more DDoSmitigation services. Furthermore, the processor 302 may be configurableto mitigate the DDoS event by the one or more DDoS mitigation services.

In an example embodiment, the DDoS mitigation service may analyze thenetwork data traffic to detect DDoS data packages. After the analysis,the DDoS mitigation service may filter the DDoS data packages to providefiltered network data traffic.

In an example embodiment, the processor 302 may be further configurableto receive an indication of reestablishment of the network data trafficthrough the collapsible virtual data circuit. To obtain the indication,the processor 302 may send a request to a health monitor associated withthe collapsible virtual data circuit. In response to the request, theprocessor 302 may receive, from the health monitor, a notificationconcerning the presence of the network data traffic in the collapsiblevirtual data circuit. The processor 302 may attribute the notificationconcerning the presence of the network data traffic in the collapsiblevirtual data circuit to successful mitigation of the DDoS event. Afterreceiving of the indication of the reestablishment, the processor 302may direct the network data traffic back to the collapsible virtual datacircuit. The network data traffic directed back to the collapsiblevirtual data circuit may include the filtered network data.

In an example embodiment, the processor 302 may be configurable toreceive the indication of the collapse of the collapsible virtual datacircuit and the indication of the reestablishment of the network datatraffic through the collapsible virtual data circuit via at least one ofthe following: Ethernet, IP, and SDN.

In an example embodiment, the processor 302 may be further configurableto change a Domain Name System (DNS) name upon receiving the indicationof the collapse of the collapsible virtual data circuit.

In an example embodiment, the system 300 may optionally comprise amemory 304 that may store instructions and code implementable by theprocessor 302.

FIG. 4 shows a diagrammatic representation of a machine in the exampleelectronic form of a computer system 400, within which a set ofinstructions for causing the machine to perform any one or more of themethodologies discussed herein may be executed. In various exampleembodiments, the machine operates as a standalone device or may beconnected (e.g., networked) to other machines. In a networkeddeployment, the machine may operate in the capacity of a server or aclient machine in a server-client network environment, or as a peermachine in a peer-to-peer (or distributed) network environment. Themachine may be a PC, a tablet PC, a set-top box (STB), a cellulartelephone, a portable music player (e.g., a portable hard drive audiodevice such as an Moving Picture Experts Group Audio Layer 3 (MP3)player), a web appliance, a network router, switch or bridge, or anymachine capable of executing a set of instructions (sequential orotherwise) that specify actions to be taken by that machine. Further,while only a single machine is illustrated, the term “machine” shallalso be taken to include any collection of machines that individually orjointly execute a set (or multiple sets) of instructions to perform anyone or more of the methodologies discussed herein.

The example computer system 400 includes a processor or multipleprocessors 402 (e.g., a central processing unit (CPU), a graphicsprocessing unit (GPU), or both), a main memory 404 and a static memory406, which communicate with each other via a bus 408. The computersystem 400 may further include a video display unit 410 (e.g., a liquidcrystal display (LCD) or a cathode ray tube (CRT)). The computer system400 may also include an alphanumeric input device 412 (e.g., akeyboard), a cursor control device 414 (e.g., a mouse), a disk driveunit 416, a signal generation device 418 (e.g., a speaker), and anetwork interface device 420.

The disk drive unit 416 includes a non-transitory computer-readablemedium 422, on which is stored one or more sets of instructions and datastructures (e.g., instructions 424) embodying or utilized by any one ormore of the methodologies or functions described herein. Theinstructions 424 may also reside, completely or at least partially,within the main memory 404 and/or within the processors 402 duringexecution thereof by the computer system 400. The main memory 404 andthe processors 402 may also constitute machine-readable media.

The instructions 424 may further be transmitted or received over anetwork 426 via the network interface device 420 utilizing any one of anumber of well-known transfer protocols (e.g., Hyper Text TransferProtocol (HTTP)).

While the computer-readable medium 422 is shown in an example embodimentto be a single medium, the term “computer-readable medium” should betaken to include a single medium or multiple media (e.g., a centralizedor distributed database and/or associated caches and servers) that storethe one or more sets of instructions. The term “computer-readablemedium” shall also be taken to include any medium that is capable ofstoring, encoding, or carrying a set of instructions for execution bythe machine and that causes the machine to perform any one or more ofthe methodologies of the present application, or that is capable ofstoring, encoding, or carrying data structures utilized by or associatedwith such a set of instructions. The term “computer-readable medium”shall accordingly be taken to include, but not be limited to,solid-state memories, optical and magnetic media, and carrier wavesignals. Such media may also include, without limitation, hard disks,floppy disks, flash memory cards, digital video disks, random accessmemory (RAMs), read only memory (ROMs), and the like.

The example embodiments described herein can be implemented in anoperating environment comprising computer-executable instructions (e.g.,software) installed on a computer, in hardware, or in a combination ofsoftware and hardware. The computer-executable instructions can bewritten in a computer programming language or can be embodied infirmware logic. If written in a programming language conforming to arecognized standard, such instructions can be executed on a variety ofhardware platforms and for interfaces to a variety of operating systems.Although not limited thereto, computer software programs forimplementing the present method can be written in any number of suitableprogramming languages such as, for example, Hypertext Markup Language(HTML), Dynamic HTML, Extensible Markup Language (XML), ExtensibleStylesheet Language (XSL), Document Style Semantics and SpecificationLanguage (DSSSL), Cascading Style Sheets (CSS), Synchronized MultimediaIntegration Language (SMIL), Wireless Markup Language (WML), Java™,Jini™, C, C++, Perl, UNIX Shell, Visual Basic or Visual Basic Script,Virtual Reality Markup Language (VRML), ColdFusion™ or other compilers,assemblers, interpreters or other computer languages or platforms.

Thus, methods and systems for mitigating a DDoS event are disclosed.Although embodiments have been described with reference to specificexample embodiments, it will be evident that various modifications andchanges can be made to these example embodiments without departing fromthe broader spirit and scope of the present application. Accordingly,the specification and drawings are to be regarded in an illustrativerather than a restrictive sense.

What is claimed is:
 1. A method implemented by at least one hardwareprocessor for mitigating a distributed denial of service (DDoS) eventcomprising: sending a request to a health monitor regarding a state of afirst computing system, the health monitor comprising a second computingsystem, the health monitor determining presence of network data trafficthrough a collapsible virtual data circuit that normally conveys thenetwork data traffic and collapses in response to a DDoS event bystopping flow of the network data traffic; ascertaining the healthmonitor has failed, the failure being evidenced by the lack of aresponse to the request; determining there is an interruption of thenetwork data traffic due to a collapse of the collapsible virtual datacircuit using the ascertained failure; attributing the interruption ofthe network data traffic due to the collapse of the collapsible virtualdata circuit to a DDoS event; triggering redirection of the network datatraffic to a DDoS mitigation service, the DDoS mitigation servicecomprising a third computing system; sending a further request to thehealth monitor regarding the presence of the network data traffic in thecollapsible virtual data circuit; in response to the further requestsent to the health monitor, receiving an indication from the healthmonitor of the presence of the network data traffic in the collapsiblevirtual data circuit, the presence of the network data traffic in thecollapsible virtual data circuit being attributed to a successfulmitigation of the DDoS event; and triggering direction of the networkdata traffic back to the collapsible virtual data circuit.
 2. The methodof claim 1, wherein the health monitor includes at least one of:software, signaling, and database query.
 3. The method of claim 1,wherein the DDoS mitigation service: analyzes the network data trafficto detect DDoS data packages, and filters the DDoS data packages toprovide filtered network data traffic.
 4. The method of claim 3, whereinthe network data traffic present in the collapsible virtual data circuitincludes the filtered network data traffic.
 5. The method of claim 1,wherein the receiving of the indication from the health monitor isperformed via at least one of the following: Ethernet, Internet Protocol(IP), and software defined network (SDN).
 6. The method of claim 1,further comprising: updating a Domain Name System (DNS) name in responseto the determining there is the interruption of the network data trafficdue to the collapse of the collapsible virtual data circuit.
 7. Themethod of claim 1, wherein an additional circuit is activated and thenetwork data traffic is routed through the additional circuit due to thecollapse of the collapsible virtual data circuit.
 8. The method of claim1, wherein the health monitor is configured to be connected to anapplication delivery controller (ADC) or an external DDoS service.
 9. Asystem for mitigating a DDoS event comprising: a hardware processor; anda memory coupled to the hardware processor, the memory storinginstructions executable by the hardware processor to perform a methodcomprising: sending a request to a health monitor regarding a state of afirst computing system, the health monitor comprising a second computingsystem, the health monitor determining presence of network data trafficthrough a collapsible virtual data circuit that normally conveys thenetwork data traffic and collapses in response to a DDoS event bystopping flow of the network data traffic; ascertaining the healthmonitor has failed, the failure being evidenced by the lack of aresponse to the request; determining there is an interruption of thenetwork data traffic due to a collapse of the collapsible virtual datacircuit using the ascertained failure; redirects the network datatraffic to one or more DDoS mitigation services; attributing theinterruption of the network data traffic due to the collapse of thecollapsible virtual data circuit to a DDoS event; triggering redirectionof the network data traffic to a DDoS mitigation service, the DDoSmitigation service comprising a third computing system; sending afurther request to the health monitor regarding the presence of thenetwork data traffic in the collapsible virtual data circuit; inresponse to the further request sent to the health monitor, receiving anindication form the health monitor of the presence of the network datatraffic in the collapsible virtual data circuit, the presence of thenetwork data traffic in the collapsible virtual data circuit beingattributed to a successful mitigation of the DDoS event; and triggeringdirection of the network data traffic back to the collapsible virtualdata circuit.
 10. The system of claim 9, wherein the health monitorincludes at least one of: software, signaling, and database query. 11.The system of claim 9, wherein the DDoS mitigation service: analyzes thenetwork data traffic to detect DDoS data packages; and filters the DDoSdata packages to provide filtered network data traffic.
 12. The systemof claim 11, wherein the network data traffic present in the collapsiblevirtual data circuit includes the filtered network data traffic.
 13. Thesystem of claim 9, wherein the receiving of the indication from thehealth monitor is performed via at least one of Ethernet, InternetProtocol (IP), and software defined network (SDN).
 14. The system ofclaim 9, wherein the method further comprises: updating a Domain NameSystem (DNS) name in response to the determining there is theinterruption of the network data traffic due to the collapse of thecollapsible virtual data circuit.
 15. The system of claim 9, wherein anadditional circuit is activated and the network data traffic is routedthrough the additional circuit due to the collapse of the collapsiblevirtual data circuit.
 16. A non-transitory computer-readable storagemedium having embodied thereon a program, the program being executableby at least one processor to perform a method comprising: sending arequest to a health monitor regarding a state of a first computingsystem, the health monitor comprising a second computing system, thehealth monitor determining presence of network data traffic through acollapsible virtual data circuit that normally conveys the network datatraffic and collapses in response to a DDoS event by stopping flow ofthe network data traffic; ascertaining the health monitor has failedusing, the failure being evidenced by the lack of a response to therequest; determining there is an interruption of the network datatraffic due to a collapse of the collapsible virtual data circuit usingthe ascertained failure; attributing the interruption of the networkdata traffic due to the collapse of the collapsible virtual data circuitto a DDoS event; triggering redirection of the network data traffic to aDDoS mitigation service, the DDoS mitigation service comprising a thirdcomputing system; sending a further request to the health monitorregarding the presence of the network data traffic in the collapsiblevirtual data circuit; in response to the further request sent to thehealth monitor, receiving an indication from the health monitor of thepresence of the network data traffic in the collapsible virtual datacircuit, the presence of the network data traffic in the collapsiblevirtual data circuit being attributed to a successful mitigation of theDDoS event; and triggering direction of the network data traffic back tothe collapsible virtual data circuit.